I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength.

Dictionary words are an easy target for password crackers. If you compound a word, such as batteryhorse which clearly is not in the dictionary, do password crackers have an easier time of it than just by brute-forcing a 12-letter combination? In other words is it more or less crackable than, say, abcdefgjihk or qpwosugnelso?

For this question, I am leaving out other characters or longer passwords. I am just asking whether some cracking algorithms handle compound words better than brute force.

  • 1
    This is a question if an attacker is an irrational moron or a calculating sharpie.
    – techraf
    Oct 23 '16 at 11:01
  • 1
    @techraf The attacker is a piece of software. That makes it a calculating moron, I suppose.
    – Manngo
    Oct 23 '16 at 21:29
  • 1
    A piece of software does not pay the electricity bill to run itself.
    – techraf
    Oct 23 '16 at 22:32